tornadocash-v2[.]org

The domain tornadocash-v2.org is a phishing site involved in brand impersonation targeting the cryptocurrency service across. It is classified as an elevated risk scam that falsely presents itself with the page title Tornado Cash: Secure & Anonymous Ethereum Mixer | tornado.cash. The site has been taken offline and does not currently pose an active threat, but its prior use as a phishing domain makes it unsafe to visit.

Technical analysis shows tornadocash-v2.org was registered on February 21, 2026, through Web Commerce Communications Limited dba WebNic.cc. It resolves to IP address 104.21.64.1 located in the US under AS13335 Cloudflare, Inc. The domain holds an SSL certificate issued by WE1 and uses nameservers ns100.webnic.cc and ns101.webnic.cc. VirusTotal detected 1 of 95 security vendors flagging the domain, including Gridinsoft which assigned a trust score of 0 out of 100. The domain is listed on one security blocklist, PhishDestroy.

Users who encountered tornadocash-v2.org or suspect exposure to this brand impersonation phishing scam should avoid interacting with the domain and ensure no credentials or cryptocurrency tokens were compromised. For cryptocurrency scams, it is advised to revoke token approvals and transfer assets to a secure wallet. Users should change any passwords potentially exposed and enable two-factor authentication to reduce risk. Suspicious activity should be reported to relevant security organizations and blocklists such as PhishDestroy to aid mitigation efforts.